feat: implement tenant OAuth flow and guest achievements

app/Http/Middleware/CreditCheckMiddleware.php

@@ -2,23 +2,18 @@
 
 namespace App\Http\Middleware;
 
+use App\Models\Event;
+use App\Models\Tenant;
 use Closure;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
-use App\Models\Tenant;
-use App\Models\Event;
 
 class CreditCheckMiddleware
 {
     public function handle(Request $request, Closure $next): Response
     {
         if ($request->isMethod('post') && $request->routeIs('api.v1.tenant.events.store')) {
-            $user = $request->user();
-            if (!$user) {
-                return response()->json(['message' => 'Unauthenticated'], 401);
-            }
-
-            $tenant = Tenant::findOrFail($user->tenant_id);
+            $tenant = $this->resolveTenant($request);
 
             if ($tenant->event_credits_balance < 1) {
                 return response()->json(['message' => 'Insufficient event credits'], 422);
@@ -30,10 +25,28 @@ class CreditCheckMiddleware
             $event = Event::where('slug', $eventSlug)->firstOrFail();
             $tenant = $event->tenant;
 
-            // For update, no credit check needed (already consumed on create)
             $request->merge(['tenant' => $tenant]);
         }
 
         return $next($request);
     }
-}
+
+    private function resolveTenant(Request $request): Tenant
+    {
+        $user = $request->user();
+        if ($user && isset($user->tenant) && $user->tenant instanceof Tenant) {
+            return $user->tenant;
+        }
+
+        $tenantId = $request->attributes->get('tenant_id');
+        if (! $tenantId && $user && isset($user->tenant_id)) {
+            $tenantId = $user->tenant_id;
+        }
+
+        if (! $tenantId) {
+            abort(401, 'Unauthenticated');
+        }
+
+        return Tenant::findOrFail($tenantId);
+    }
+}